BMO customer hit by data breach unhappy with bank's lack of answers

John Zinck is having a hard time getting a consistent answer from BMO about when his account was breached and how.

'It's going to be a lot of headaches just to get things fixed,' says John Zinck

Richard Woodbury · CBC · Posted: Aug 30, 2018 5:00 AM EDT | Last Updated: August 30, 2018

John Zinck is frustrated BMO officials have given him conflicting information about when the data breach occurred and how many people it affected. (CBC)

A Halifax-area man whose personal information with the Bank of Montreal was improperly accessed says he hasn't gotten a clear answer from the financial institution on when the privacy breach occurred or how many customers were affected.

John Zinck of Bedford recently received a letter from BMO, dated Aug. 16, saying that a third party had gained access to his personal information, which may have included his name, contact details, debit card account information and security login information.

So your financial information is being bought and sold on the internet. Now what?

Analysis
Hacking attacks at BMO and CIBC's Simplii highlight why cybersecurity cannot be a patchwork job: Don Pittis

As he read the letter, Zinck — who's twice had a credit card stolen and used to rack up charges — had a sinking feeling.

"This isn't going to be good," he said. "It's going to be a lot of headaches just to get things fixed."

Looking for a straight answer

Zinck said he's been trying to get a clearer understanding of what happened but BMO has been giving him inconsistent answers.

BMO did not respond to repeated requests for comment.

Zinck said he's been told by officials — including his local branch manager — that the breach happened in May, while another official said it was in June. Another said the breach happened recently, which is why he just received a letter.

In late May, BMO and CIBC-owned Simplii Financial warned that hackers had accessed the personal and account information of about 90,000 customers.

The letter from BMO said the third party gained access to John Zinck's personal information, which might have included his name, contact details, debit card account information and security login information. (CBC)

Zinck said he's been told he was one of 50,000 customers impacted by the breach, which corresponds with the number of BMO customers whose information was hacked in May. However, Zinck was also told he was part of a much smaller group — just 100 customers — whose data was accessed.

"How many data breaches are they actually having?" said Zinck.

BMO officials told Zinck the breach happened after hackers accessed his online banking information. But Zinck said he doesn't use online banking and never signed up for it.

He said the bank has offered to cover any losses stemming from the breach, as well as free credit monitoring for two years.

Stolen credit cards

Adding to his frustration is the fact that Zinck has dealt with banking-related breaches of privacy on two other occasions.

While working as an English teacher in Czechoslovakia in 1990, Zinck's credit card was stolen and while he cancelled it, a fraudster later used it to ring up bills.

"They seemed to like the fine life," said Zinck.

John Zinck received the letter from BMO last Friday. (CBC)

The second incident happened in 1996 when Zinck's belongings were stolen during his honeymoon in Florida.

He cancelled his credit cards and everything appeared fine — until MasterCard called about eight months later, asking if Zinck was trying to rent eight cars in Miami.